Issues (168)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/query/Generic.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php declare(strict_types=1);
2
/**
3
 * Created by PhpStorm.
4
 * User: VITALYIEGOROV
5
 * Date: 08.12.15
6
 * Time: 23:11
7
 */
8
namespace samsoncms\api\query;
9
10
use samsoncms\api\generated\Material;
11
use samsonframework\orm\ArgumentInterface;
12
13
/**
14
 * TODO: We have create a Record class that lays behind Entity-Generic and we store entity fields in fieldIDs static variable
15
 * which cannot be accessed in parent function calls like orderBy, applySorting, to get intermediary static class variables
16
 * from Generic class. This affect code duplication of method in Record to Generic to give access to static class fields
17
 * described in fieldIDs.
18
 */
19
20
/**
21
 * Material with additional fields query.
22
 *
23
 * @package samsoncms\api
24
 */
25
class Generic extends Record
26
{
27
    /** @var string Table class name */
28
    public static $identifier = Material::class;
29
30
    /** @var string Database table name */
31
    public static $tableName = 'material';
32
33
    /** @var string Table primary field name */
34
    public static $primaryFieldName = Material::F_PRIMARY;
35
36
       /** @var array Collection of all supported entity fields */
37
    public static $fieldIDs = array(
38
        Material::F_PRIMARY=> Material::F_PRIMARY,
39
        Material::F_PRIORITY => Material::F_PRIORITY,
40
        Material::F_URL => Material::F_URL,
41
        Material::F_DELETION => Material::F_DELETION,
42
        Material::F_PUBLISHED => Material::F_PUBLISHED,
43
        Material::F_PARENTID => Material::F_PARENTID,
44
        Material::F_CREATED => Material::F_CREATED,
45
        Material::F_MODYFIED => Material::F_MODYFIED,
46
    );
47
48
    /** @var array Collection of all supported entity fields */
49
    public static $fieldNames = array(
50
        Material::F_PRIMARY => Material::F_PRIMARY,
51
        Material::F_PRIORITY => Material::F_PRIORITY,
52
        Material::F_URL => Material::F_URL,
53
        Material::F_DELETION => Material::F_DELETION,
54
        Material::F_PUBLISHED => Material::F_PUBLISHED,
55
        Material::F_PARENTID => Material::F_PARENTID,
56
        Material::F_CREATED => Material::F_CREATED,
57
        Material::F_MODYFIED => Material::F_MODYFIED
58
    );
59
60
    /** @var array Collection of entity field types */
61
    public static $fieldTypes = [
62
        'MaterialID' => 'int',
63
        'parent_id' => 'int',
64
        'priority' => 'int',
65
        'Name' => 'string',
66
        'Url' => 'string',
67
        'Created' => 'int',
68
        'Modyfied' => 'int',
69
        'UserID' => 'int',
70
        'Draft' => 'int',
71
        'type' => 'int',
72
        'Published' => 'int',
73
        'Active' => 'int',
74
        'system' => 'int',
75
        'remains' => 'float',
76
    ];
77
78
    /** @var array Collection of entity field database types */
79
    public static $fieldDataTypes = [
80
        'MaterialID' => 'int',
81
        'parent_id' => 'int',
82
        'priority' => 'int',
83
        'Name' => 'varchar',
84
        'Url' => 'varchar',
85
        'Created' => 'datetime',
86
        'Modyfied' => 'timestamp',
87
        'UserID' => 'int',
88
        'Draft' => 'int',
89
        'type' => 'int',
90
        'Published' => 'int',
91
        'Active' => 'int',
92
        'system' => 'int',
93
        'remains' => 'float',
94
    ];
95
96
    /** @var array Collection of entity field database default values */
97
    public static $fieldDefaults = [
98
        'MaterialID' => '',
99
        'parent_id' => '',
100
        'priority' => 0,
101
        'Name' => '',
102
        'Url' => '',
103
        'Created' => '',
104
        'Modyfied' => 'CURRENT_TIMESTAMP',
105
        'UserID' => '',
106
        'Draft' => 0,
107
        'type' => 0,
108
        'Published' => '',
109
        'Active' => '',
110
        'system' => 0,
111
        'remains' => 0,
112
    ];
113
114
    /** @var array Collection of entity field database is nullable values */
115
    public static $fieldNullable = [
116
        'MaterialID' => 'NO',
117
        'parent_id' => 'YES',
118
        'priority' => 'NO',
119
        'Name' => 'NO',
120
        'Url' => 'NO',
121
        'Created' => 'YES',
122
        'Modyfied' => 'NO',
123
        'UserID' => 'YES',
124
        'Draft' => 'NO',
125
        'type' => 'NO',
126
        'Published' => 'YES',
127
        'Active' => 'YES',
128
        'system' => 'NO',
129
        'remains' => 'NO',
130
    ];
131
132
    /** @var string Entity navigation identifiers */
133
    public static $navigationIDs = array();
134
135
    /**
136
     * Add primary field query condition.
137
     *
138
     * @param string $value Field value
139
     * @param string $relation @see ArgumentInterface types
140
     *
141
     * @return $this Chaining
142
     * @see Material::where()
143
     */
144
    public function primary($value, $relation = ArgumentInterface::EQUAL)
145
    {
146
        return $this->where(Material::F_PRIMARY, $value, $relation);
147
    }
148
149
    /**
150
     * Add identifier field query condition.
151
     *
152
     * @param string $value Field value
153
     * @param string $relation @see ArgumentInterface types
154
     *
155
     * @return $this Chaining
156
     * @see Material::where()
157
     */
158
    public function identifier($value, $relation = ArgumentInterface::EQUAL)
159
    {
160
        return $this->where(Material::F_URL, $value, $relation);
161
    }
162
163
    /**
164
     * Add active flag condition.
165
     *
166
     * @param bool $value Field value
167
     * @param string $relation @see ArgumentInterface types
168
     *
169
     * @return $this Chaining
170
     * @see Material::where()
171
     */
172
    public function active($value, $relation = ArgumentInterface::EQUAL)
173
    {
174
        return $this->where(Material::F_ACTIVE, $value, $relation);
175
    }
176
177
    /**
178
     * Add entity published field query condition.
179
     *
180
     * @param string $value Field value
181
     * @param string $relation @see ArgumentInterface types
182
     *
183
     * @return $this Chaining
184
     * @see Material::where()
185
     */
186
    public function published($value, $relation = ArgumentInterface::EQUAL)
187
    {
188
        return $this->where(Material::F_PUBLISHED, $value, $relation);
189
    }
190
191
    /**
192
     * Add entity creation field query condition.
193
     *
194
     * @param string $value Field value
195
     * @param string $relation @see ArgumentInterface types
196
     *
197
     * @return $this Chaining
198
     * @see Material::where()
199
     */
200
    public function created($value, $relation = ArgumentInterface::EQUAL)
201
    {
202
        return $this->where(Material::F_CREATED, $this->convertToDateTime($value), $relation);
203
    }
204
205
    /**
206
     * Add entity modification field query condition.
207
     *
208
     * @param string $value Field value
209
     * @param string $relation @see ArgumentInterface types
210
     * @return $this Chaining
211
     * @see Material::where()
212
     */
213
    public function modified($value, $relation = ArgumentInterface::EQUAL)
214
    {
215
        return $this->where(Material::F_MODIFIED, $this->convertToDateTime($value), $relation);
216
    }
217
218
    /**
219
     * Set field for sorting.
220
     * TODO: We have code duplication in Record::orderBy() due to late static binding
221
     * @param string $fieldName Additional field name
222
     * @param string $order     Sorting order
223
     *
224
     * @return $this Chaining
225
     */
226 View Code Duplication
    public function orderBy($fieldName, $order = 'ASC')
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
227
    {
228
        if (in_array($fieldName, self::$fieldIDs)) {
229
            $this->orderBy = array($fieldName, $order);
230
        }
231
232
        return $this;
233
    }
234
235
    /**
236
     * Add sorting to entity identifiers.
237
     * TODO: We have code duplication in Record::orderBy() due to late static binding
238
     * @param array  $entityIDs
239
     * @param string $fieldName Additional field name for sorting
240
     * @param string $order     Sorting order(ASC|DESC)
241
     *
242
     * @return array Collection of entity identifiers ordered by additional field value
243
     */
244 View Code Duplication
    protected function applySorting(array $entityIDs, $fieldName, $order = 'ASC')
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
245
    {
246
        if (array_key_exists($fieldName, self::$fieldIDs)) {
247
            // Order by parent fields
248
            return $this->query
249
                ->entity(static::$identifier)
250
                ->where(static::$primaryFieldName, $entityIDs)
251
                ->orderBy($fieldName, $order)
252
                ->fields(static::$primaryFieldName);
253
        } else { // Nothing is changed
254
            return $entityIDs;
255
        }
256
    }
257
}
258